Care home and 'care at home' service providers - FOISA extension: consultation analysis

5. Impact assessments

The Scottish Government notes in the consultation document that a Business and Regulatory Impact Assessment and a Data Protection Impact Assessment are under development. Additionally, they are required to consider the impact of the proposals in relation to the protected characteristics under the Equality Act 2010 and how they may affect inequalities of outcome caused by socio-economic disadvantage. Views were sought from respondents on these topics to help inform this work. Respondent’s views are collated in this chapter.

Q10. Do you have any comments on the business and regulatory impact of FOISA extension?

Nearly three fifths of all respondents left an open comment at Q10. The most prevalent themes were concerns regarding cost and capacity issues, both of which were raised by many respondents. Thereafter, it was felt that extending FOISA would divert resources from service delivery and that it was not needed / existing mechanisms are sufficient, both of which were raised by several respondents. All these issues are addressed in Chapter 2, with the remaining theme about the potential market impact described below.

Market impact

Several respondents commented on the market impact of implementing a FOISA extension. Some respondents commented on the potential impact on provider viability and sustainability, particularly in an already financially pressured sector (see ‘Capacity issues’ in Chapter 2). One care provider raised the potential for operational complexity and an uneven regulatory and commercial environment for UK-wide operators due to different rules operating in Scotland. They felt this may result in separating Scottish operations from wider structures, leading to reduced efficiencies due to a loss of economies of scale.

A few respondents raised concerns that FOI requests could be used to obtain commercially sensitive information, potentially affecting competitiveness, contract bidding, and negotiations (see also Q1). One care provider suggested using the commercial exemption clause to prevent disadvantaging contract bidding and negotiations.

"SCVO’s members have previously raised concerns that FOISA could be misused by organisations with a commercial interest to secure information to cause harm or slow down and undermine goals and outcomes that NGOs are working towards." - Enable

"It is not clear why competition between care homes should be risked, to provide additional disclosure duties, on entities to which the law was never intended to apply." - The Care Concern Group Limited

Other comments

Some respondents raised concerns regarding data, which have been incorporated in the analysis of Q11. A few raised privacy concerns, incorporated at Q13.

Q11. Do you have any comments on impact of FOISA extension in relation to the fulfilment of data protection rights and obligations?

Half of all respondents left an open comment at Q11. The most prevalent themes were data concerns, the need for guidance (these comments have been incorporated in the analysis of responses to Q8) and the need for compatibility with existing data regulations.

Data concerns

The most prevalent theme at this question, commented on by many respondents, was concerns that extending FOISA increases the risk and complexity of managing sensitive personal data. Respondents expressed concerns about the risk of data breaches and inadvertent disclosures, and that a FOISA extension could create more opportunities for accidental disclosures due to errors in judgment, misunderstandings of exemptions and inadequate redactions. In addition, the risk of duplication of responses to information requests relating to care services outsourced by local authorities was raised. It was noted that all of these scenarios could harm service users, cause distress to individuals and families, and potentially breach GDPR.

Respondents also highlighted the complexity between FOISA and data protection duties, such as UK GDPR and Data Subject Access Requests, raising concerns around the complexity and impact of the extension on current data protection compliance. In addition, one care provider noted that extending FOISA would likely bring providers within the scope of the Environmental Information (Scotland) Regulations 2004, creating additional regulatory burden and associated costs, which it felt had not been adequately assessed. It was also noted that those responsible for processing requests may experience challenges, especially among smaller providers, as knowledge of the correct legislative base for particular requests would be required.

"The legal regimes for FOISA and UK GDPR for data protection rights and obligations are fundamentally different, with different individuals being able to use the distinct rights, in respect of different information, and subject to different rules and safeguards, each with totally opposed objectives - unconditional publication of any recorded data on request, compared to private rights in respect of a person’s own personal data only, and its use subject to strict confidentiality and security controls. The proposed change to FOISA should not be seen as an extension of data protection rights (which is in any event retained and not devolved legislation). We have serious concerns about the impact of the extension of FOISA on ongoing data protection compliance, as care home staff will be faced with public requests for data which they must disclose by default unless exempt – and will then have to assess what is personal data and justify reliance on the relevant exemption.” - Boclair Care Home

Compatibility with existing data protection legislation

The next most prevalent theme at this question, commented on by some respondents, was that a FOISA extension should align with existing data protection processes. For instance, the Scottish Information Commissioner commented that existing information handling processes could support the implementation of a FOISA extension, with organisations being able to use their current data protection systems when responding to requests.

Respondents considered existing data protection frameworks, such as UK GDPR and the Data Protection Act 2018, to be already well understood due to being routinely applied across sectors, such as health, social care and children’s services. It was felt that a FOISA extension should comply with these.

Other comments

Some other respondents called for training (see Q7) or raised complexities arising from confusion between FOI and data protection rights and defining the scope of FOISA.

Q12. Do you have any comments on how the proposed extension might impact differently, whether positively or negatively, on different people in Scotland in relation to any of the protected characteristics mentioned above?

Just under half of all respondents left an open comment at Q12. The most prevalent themes were comments on age and disability.

Several respondents commented on the potential for a FOISA extension to have both positive and negative impacts in relation to age. Most comments under this theme related to older people, with a few referencing younger people. The most common view was that older people could be disproportionately affected by the extension compared with other groups, as they are the main users of care services, and would be most affected by any changes. A FOISA extension was felt to potentially benefit older people through improved oversight and information access from increased transparency. Respondents felt that this could strengthen rights and increase people’s ability to scrutinise services.

“Groups who are more likely to access care services, particularly older people and disabled people, may benefit indirectly from the greater parity and transparency that FOISA extension would bring. Ensuring that all care providers, regardless of sector, are subject to the same standards of openness may help strengthen rights-based approaches and support individuals and families to understand and scrutinise the care being provided.” - Social Work Scotland

A few respondents commented on the impact of the proposed extension on children and young people, calling for specific consideration in relation to safeguarding, stronger privacy protections and advocacy support (see also Q5 and Q8).

Another theme raised by several respondents was the potential for the proposed extension to affect disabled people in Scotland. Potential negative impacts of the proposed extension on disabled people have been covered elsewhere, such as that it could divert funds from frontline care (see Chapter 2), that there could be safeguarding risks if people were inadvertently identified or that there could be heightened anxiety or concern among service users or families around the incorrect handling of sensitive information.

Conversely, some respondents commented on the beneficial impact the proposed extension could have on disabled people, such as greater transparency and accountability, better access to information and strengthened rights.

Some respondents raised privacy concerns across all groups, and some others raised transparency opportunities, both incorporated at Q13. Capacity concerns and the impact of a FOISA extension on frontline delivery were raised by some respondents, with a view that this could disproportionately impact those using care services, such as older people, women and those with disabilities. A few respondents suggested there could be impacts on the female workforce due to administrative burden. A few others highlighted the need for accessibility, especially in relation to information about FOI rights and wider communication (see Q8). A few respondents also called for more evidence and assessments, such as an Equality Impact Assessment.

Q13. Do you have any comments on how the proposed extension might impact on the human rights of people in Scotland or beyond?

Just over half of all respondents left an open comment at Q13. The most common themes in order of prevalence were general positive views about extending FOISA, an opposing view that a FOISA extension was not needed and views on how a FOISA extension could be implemented (see Q7). The first two themes were addressed in Chapter 2; therefore, the analysis below focuses on the next most commonly mentioned themes.

Transparency

Some respondents at Q13, and some at Q12 and Q14, whose comments have been incorporated here, described the potential benefits of increased transparency and accountability if FOISA is extended. It was suggested that this would strengthen people’s rights by allowing for more public scrutiny and enabling them to be more informed, which in turn would encourage providers to be more accountable for the services they deliver.

“Care home and care at home services support some of the most vulnerable people in society and ensuring that all providers are subject to the same level of public scrutiny helps reinforce rights such as dignity, safety, autonomy and the ability to challenge decisions that affect an individual’s care.” - Social Work Scotland

Balancing rights

Some respondents expressed the view that extending FOISA to care providers risks creating tension between transparency and data protection. Respondents felt the extension would need to be carefully balanced, noting risks to confidentiality and dignity arising from the possibility that sensitive information could be disclosed, especially in small services where individuals may be more easily identifiable (see ‘Privacy’ below).

It was felt that more work was required to balance rights, such as the right to transparency, privacy, family life and enjoyment of possessions. Strong safeguards were recommended to prevent a FOISA extension inadvertently compromising or breaching rights. One respondent suggested aligning the approach with drivers in the Scottish Government’s Equality and Human Rights Mainstreaming Toolkit (2025).

“In settings where sensitive data is deeply linked with operational records, FOISA obligations may inadvertently compromise the rights of data subjects unless robust exemptions and safeguards are applied consistently.” - Sight Scotland & Sight Scotland Veterans

Privacy

Some respondents at Q13, as well as some at Q11 and Q12, and a few at Q10, whose comments have been incorporated here, expressed concerns about privacy and anonymity, and felt the proposed extension could have a negative impact on human rights.

Respondents felt the proposed extension could create human rights risks through breaches of privacy, with the possibility of sensitive information being disclosed and the risk that individuals could be identified from anonymised or redacted information. This was noted as being a heightened risk in small services, rural communities, and for children and young people. Respondents highlighted the potential harm that individuals could experience through unintentional disclosures, especially those already facing stigma or marginalisation. The risk of raw data being taken out of context and damaging the reputations of service users or staff was also mentioned, such as through sensationalist media reporting.

“Unsubstantiated complaints, or raw data taken out of context, could lead to reputational damage to individuals (service users and staff), their right to privacy, threats and/or harassment. Smaller providers which have one or two service users could be easier targets for FOIs and may impact on human rights given the ability to target specific information. This may have increased risk in rural communities.” - North Ayrshire Health and Social Care Partnership

Other comments

Some respondents felt the proposed extension would have no impact on human rights as regulation is already in place to protect individuals, that the information is already available and accessible, and the view that any extension should be applied and resourced responsibly.

Q14. Do you have any comments on how the proposed extension might impact individuals affected by socio-economic disadvantage?

Just over two fifths of all respondents left an open comment at Q14. The most prevalent views were barriers and mitigations, then concerns regarding cost and negative views. These latter two issues are addressed in Chapter 2.

Barriers and mitigations

Some respondents commented on barriers that may limit the extent to which people affected by socio-economic disadvantage are able to benefit from the proposed extension, alongside suggestions for how these barriers could be mitigated. Possible barriers included:

• People having limited awareness of FOISA and how to use it.
• Digital exclusion impacting the ability to navigate formal FOISA processes.
• Rigid procedural requirements inhibiting access to information, especially when contrasted with the more flexible rights afforded by GDPR.
• A lack of confidence when navigating formal bureaucratic processes.
• Those caused by low literacy and language issues.
• Power dynamics, e.g. fear of repercussions.

On this latter point, one respondent noted unpaid carers with whom they had consulted expressed a desire for safeguards to ensure that using FOISA would not negatively impact their relationship with the care provider or the care received by the person they cared for. The fear of repercussions was highlighted by these carers, indicating that this represented a major barrier to using FOISA. In addition, it was noted that without support, people affected by socio-economic disadvantage may be less likely to make requests and benefit from the extension.

“National data shows that individuals from disadvantaged backgrounds often lack information about FOISA and how to leverage it effectively.” - West Dunbartonshire HSCP

Under this theme, some respondents suggested a range of mitigations. These included providing clear and accessible guidance that addressed these issues and recognised the vulnerability of people making FOI requests, information provided in multiple formats, advocacy support services, and proactive awareness raising (see also Q8).

No impact

Some respondents felt the proposed extension would have no impact on individuals affected by socio-economic disadvantage, though reasons for holding this view were not provided.